SKIP TO CONTENT
AI AGENTS6 minAgents in Production / Ep. 8 · Stage 8-2

AI Agent Audit Log: Tracing One Decision Step by Step

Line 0412 is off by two cents. Here is every record the agent writes before a person signs off, with nothing edited.

XIN

IN 30 SECONDS

An audit trail of one decision is the sequence of records written while the agent works: evidence, checks, decision, then any human review as a new record. Each auditor question then lands on specific fields.

KEY TAKEAWAYS · 3

  • Each auditor question lands on one part of the record: the evidence the agent actually used, the decision with any human review, and a hash chain checked against a signed checkpoint.
  • A human approval is a second record, never an edit, and a failed check is kept like a pass.
  • For records SEC Rule 17a-4(f) covers, this design’s hash chain is one part of the audit-trail option, not all of it. Ask your counsel which option you claim.
On this page

One reconciliation line, traced step by step

IN SHORT The evidence is written before the decision, and the human’s approval becomes a new record instead of an edit.

WORDS TO KNOW

Evidence
The exact part of each source document the agent actually used, with its page and position.
Escalate
Hand the case to a person instead of answering. The agent gives no answer and nothing is booked.
Hash chain
Each record includes a hash, a short fingerprint, of the record before it, so changing one row in practice breaks every hash after it.
Signed checkpoint
A signed copy of the latest hash, kept where the person or system writing the log can’t change it.

Here’s one line of a bank statement, logged with my proposed design, not a standard. The agent’s job is to match bank lines to the books. The values are made up: what matters is when each write happens.

STEP BY STEP

Sequence diagram: 5 participants: Scheduler, Agent, Checks, Audit log, ReviewerSequence diagram: 5 participants: Scheduler, Agent, Checks, Audit log, Reviewer. Step 1: Scheduler to Agent, Run one statement line. Step 2: Agent to Audit log, Write the evidence: two documents, hash and span. Step 3: Agent to Checks, Submit the proposed match. Step 4: Checks to Audit log, Record both results: off by two cents. Step 5: Agent to Audit log, Decision: escalate. No answer, nothing booked. Step 6: Audit log to Reviewer, Show the record with its evidence links. Step 7: Reviewer to Audit log, Approve, with a note naming the bank fee. Step 8: Audit log to itself, Chain each write to the one before.SCHEDULER > AGENTRun one statement lineAGENT > AUDIT LOGWrite the evidence: twodocuments, hash and spanBefore any answer exists.AGENT > CHECKSSubmit the proposed matchCHECKS > AUDIT LOGRecord both results: off bytwo centsAGENT > AUDIT LOGDecision: escalate. No answer,nothing bookedAUDIT LOG > REVIEWERShow the record with itsevidence linksREVIEWER > AUDIT LOGApprove, with a note namingthe bank feeA second record, appended.AUDIT LOG > AUDIT LOGChain each write to the onebeforeChecked against a signedcheckpoint.

Step 1. Trigger. The scheduler starts a run for one statement line.

Pick a step to see it move
  1. Trigger The scheduler starts a run for one statement line.
  2. Evidence first The agent writes what it retrieved: two documents, each with a hash and the exact span used. No answer exists yet.
  3. Checks Do the amounts match to the cent? Does the source really say this? Both results are logged, and the amount check fails by two cents.
  4. Decision The agent escalates: it hands the case to a person. The decision is a logged value, not an error.
  5. Review A reviewer sees the record, with links that open each source at the stored span.
  6. Approval appended The reviewer approves, with a note naming the bank fee behind the two cents. That’s a second record; the first is never touched.
  7. Chain Each write is chained to the one before by its hash, and the chain is checked against a signed checkpoint.
Illustrative. One statement line, four appended writes, zero edits. The first three form the agent’s record; the reviewer’s approval is a second record.

IN PLAIN WORDS

Escalate Hand the case to a person instead of answering. The agent gives no answer and nothing is booked. See the glossary means handing the case to a person. The agent gives no answer and nothing is booked, and that is a successful outcome, fully documented.

Failures are logged as fully as successes. The workflow, and why this agent was allowed to refuse, is in the bank reconciliation build.

An audit log that keeps only the passes is marketing.

Coming up next: So what does an auditor do with these records?

Three auditor questions, three sets of fields

IN SHORT Each auditor question lands on specific fields, so you answer it by opening them, not by explaining your architecture.

Auditors aren’t trying to understand your system. They’re trying to break one claim, with the Evidence The exact part of each source document the agent actually used, with its page and position. See the glossary first. An overall accuracy score can’t say which passage was used, who answered for it, or whether the log changed.

A WORKED EXAMPLE

Illustrative numbers

PASSThe auditor picks line 0412 of the July statement

INPUT

Line
stmt:2026-07/line-0412
Log
audit records, append-only

WHAT HAPPENS

  1. How did this number get here? Open evidence and inputDigest: both source documents open at the stored span, and their hashes still match. Rebuilding the input itself needs the authorized reference kept with it.
  2. Who answered for it? Read decision and humanReview: an escalation, then a second record with a named reviewer, a timestamp and the bank-fee note (or the rule that made review unnecessary).
  3. Was the log edited? Recompute chain and compare it with a trusted signed checkpoint held outside the log writer’s control.

OUTPUT

Result
output rebuilt, on demand

CAN’T REBUILDSame line, observability only

INPUT

Line
stmt:2026-07/line-0412
Data
sampled traces, 30-day retention

WHAT HAPPENS

  1. The run was sampled out, or its trace expired after 30 days.
  2. No entry says which document passage the agent used.
  3. The dashboard can be backfilled, so nothing proves it wasn’t changed.

OUTPUT

Result
only the aggregate accuracy score

Engineers underestimate the third question. In the US, the SEC, the federal securities regulator, has a precise rule for broker-dealers. Under SEC Rule 17a-4(f), an electronic system holding the records it covers has two options:

  • keep records in a non-rewriteable, non-erasable format;
  • or keep a complete, time-stamped audit trail of modifications and deletions.

WATCH OUT

This design’s Hash chain Each record includes a hash, a short fingerprint, of the record before it, so changing one row in practice breaks every hash after it. See the glossary can be one part of the second option, not all of it. On its own, it doesn’t keep what a deleted row said, record who changed it, or let you recreate the original.

You still need the old values, who changed them where applicable, and a retention period. Ask your counsel which option you’re actually claiming.

How to check a citation, not just attach one, has its own deep dive.

ITEM GET

Three questions, three answers

Where did this number come from, who answered for it, was the log edited: the evidence, the decision with its review, and the chain checked against a Signed checkpoint A signed copy of the latest hash, kept where the person or system writing the log can’t change it. See the glossary.

STAGE CLEAR

What you now know

  • In what order the records are written, and why the evidence comes before the decision.
  • Which fields answer each of the three auditor questions.
  • Why this design’s hash chain can cover only part of what Rule 17a-4(f) asks for.

Check yourself

Tap or click a question to see the answer.

Illustrative case: someone with full write access rebuilds the whole log and recomputes every hash. The chain checks out end to end. Can you trust the log?

Not from the chain alone. A consistent chain only shows the rows agree with each other. Compare it with a signed checkpoint held outside that person’s reach; a mismatch shows the log no longer matches what was signed.

Next stage:How long must you keep an agent’s audit records, and what does keeping them cost?6 min
Adam Boudjemaa
Adam Boudjemaa

Former CTO of Integra. Named author (1 of 5) of ERC-3643, first author of ERC-6960, co-author of ERC-7410, and co-author of ERC-8203, which is still a draft. Building production AI and regulated Web3 systems.

Have a project to ship or a role to fill?

Discuss your project or role
LinkedInTwitterGitHub
Follow the engineering notes

Get new articles on production AI and smart contracts by email.